Welcome to Cyberlobi News Hub
Top News Sources
Hacker News
- Former Black Basta Members Use Microsoft Teams and Python Scripts in 2025 Attacksby [email protected] (The Hacker News) on June 11, 2025 at 5:44 pm
Former members tied to the Black Basta ransomware operation have been observed sticking to their tried-and-tested approach of email bombing and Microsoft Teams phishing to establish persistent access to target networks. “Recently, attackers have introduced Python script execution alongside these techniques, using cURL requests to fetch and deploy malicious payloads,” ReliaQuest said in a report
- 295 Malicious IPs Launch Coordinated Brute-Force Attacks on Apache Tomcat Managerby [email protected] (The Hacker News) on June 11, 2025 at 1:49 pm
Threat intelligence firm GreyNoise has warned of a “coordinated brute-force activity” targeting Apache Tomcat Manager interfaces. The company said it observed a surge in brute-force and login attempts on June 5, 2025, an indication that they could be deliberate efforts to “identify and access exposed Tomcat services at scale.” To that end, 295 unique IP addresses have been found to be engaged
- INTERPOL Dismantles 20,000+ Malicious IPs Linked to 69 Malware Variants in Operation Secureby [email protected] (The Hacker News) on June 11, 2025 at 11:32 am
INTERPOL on Wednesday announced the dismantling of more than 20,000 malicious IP addresses or domains that have been linked to 69 information-stealing malware variants. The joint action, codenamed Operation Secure, took place between January and April 2025, and involved law enforcement agencies from 26 countries to identify servers, map physical networks, and execute targeted takedowns. “These
- Why DNS Security Is Your First Defense Against Cyber Attacks?by [email protected] (The Hacker News) on June 11, 2025 at 11:25 am
In today’s cybersecurity landscape, much of the focus is placed on firewalls, antivirus software, and endpoint detection. While these tools are essential, one critical layer often goes overlooked: the Domain Name System (DNS). As the starting point of nearly every online interaction, DNS is not only foundational – it’s increasingly a target. When left unsecured, it becomes a single point of
- SinoTrack GPS Devices Vulnerable to Remote Vehicle Control via Default Passwordsby [email protected] (The Hacker News) on June 11, 2025 at 10:28 am
Two security vulnerabilities have been disclosed in SinoTrack GPS devices that could be exploited to control certain remote functions on connected vehicles and even track their locations. “Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface,” the U.S. Cybersecurity and Infrastructure
Krebs on Security
- Patch Tuesday, June 2025 Editionby BrianKrebs on June 11, 2025 at 12:10 am
Microsoft today released security updates to fix at least 67 vulnerabilities in its Windows operating systems and software. Redmond warns that one of the flaws is already under active attack, and that software blueprints showing how to exploit a pervasive Windows bug patched this month are now public.
- Proxy Services Feast on Ukraine’s IP Address Exodusby BrianKrebs on June 5, 2025 at 10:44 pm
Ukraine has seen nearly one-fifth of its Internet space come under Russian control or sold to Internet address brokers since February 2022, a new study finds. The analysis indicates large chunks of Ukrainian Internet address space are now in the hands of proxy and anonymity services nested at some of America’s largest Internet service providers (ISPs).
- U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scamsby BrianKrebs on May 30, 2025 at 1:55 am
The U.S. government today imposed economic sanctions on Funnull Technology Inc., a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams, commonly known as “pig butchering.” In January 2025, KrebsOnSecurity detailed how Funnull was being used as a content delivery network that catered to cybercriminals seeking to route their traffic through U.S.-based cloud providers.
- Pakistan Arrests 21 in ‘Heartsender’ Malware Serviceby BrianKrebs on May 28, 2025 at 5:41 pm
Authorities in Pakistan have arrested 21 individuals accused of operating “Heartsender,” a once popular spam and malware dissemination service that operated for more than a decade. The main clientele for HeartSender were organized crime groups that tried to trick victim companies into making payments to a third party, and its alleged proprietors were publicly identified by KrebsOnSecurity in 2021 after they inadvertently infected their computers with malware.
- Oops: DanaBot Malware Devs Infected Their Own PCsby BrianKrebs on May 22, 2025 at 9:53 pm
The U.S. government today unsealed criminal charges against 16 individuals accused of operating and selling DanaBot, a prolific strain of information-stealing malware that has been sold on Russian cybercrime forums since 2018. The FBI says a newer version of DanaBot was used for espionage, and that many of the defendants exposed their real-life identities after accidentally infecting their own systems with the malware.
Security Week
- Securonix Acquires Threat Intelligence Firm ThreatQuotientby SecurityWeek News on June 11, 2025 at 3:24 pm
Cybersecurity heavyweight Securonix acquires ThreatQuotient to boost plans to build an all-in-one security operations stack. The post Securonix Acquires Threat Intelligence Firm ThreatQuotient appeared first on SecurityWeek.
- Maze Banks $25M to Tackle Cloud Security with AI Agentsby SecurityWeek News on June 11, 2025 at 2:42 pm
Maze and its investors are betting on finding profits in software that uses AI-powered agents to automate critical parts of the process. The post Maze Banks $25M to Tackle Cloud Security with AI Agents appeared first on SecurityWeek.
- Flaw in Industrial Computer Maker’s UEFI Apps Enables Secure Boot Bypass on Many Devicesby Eduard Kovacs on June 11, 2025 at 2:24 pm
Vulnerable DTResearch UEFI firmware applications can be used in BYOVD attacks to bypass Secure Boot. The post Flaw in Industrial Computer Maker’s UEFI Apps Enables Secure Boot Bypass on Many Devices appeared first on SecurityWeek.
- Webinar Today: Rethinking Endpoint Hardening for Today’s Attack Landscapeby SecurityWeek News on June 11, 2025 at 1:34 pm
Learn how attackers hide in plain sight—and what you can do to stop them without slowing down your business. The post Webinar Today: Rethinking Endpoint Hardening for Today’s Attack Landscape appeared first on SecurityWeek.
- Fortinet, Ivanti Patch High-Severity Vulnerabilitiesby Ionut Arghire on June 11, 2025 at 12:35 pm
Patches released by Fortinet and Ivanti resolve over a dozen vulnerabilities, including high-severity flaws leading to code execution, credential leaks. The post Fortinet, Ivanti Patch High-Severity Vulnerabilities appeared first on SecurityWeek.
Help Net Security
- Infostealer crackdown: Operation Secure takes down 20,000 malicious IPs and domainsby Help Net Security on June 11, 2025 at 5:43 pm
More than 20,000 malicious IP addresses and domains used by information-stealing malware were taken down during an international cybercrime crackdown led by INTERPOL. Called Operation Secure, the effort ran from January to April 2025 and involved law enforcement from 26 countries. Teams tracked down servers, mapped physical networks, and carried out targeted takedowns. Law enforcement seizing equipment (Source: INTERPOL) Before the operation began, INTERPOL worked with cybersecurity companies Group-IB, Kaspersky, and Trend Micro to create … More → The post Infostealer crackdown: Operation Secure takes down 20,000 malicious IPs and domains appeared first on Help Net Security.
- Connectwise is rotating code signing certificates. What happened?by Zeljka Zorz on June 11, 2025 at 2:41 pm
Connectwise customers who use the company’s ScreenConnect, Automate, and ConnectWise RMM solutions are urged to update all agents and/or validate that the update has been deployed by Friday, June 13 at 8:00 p.m. ET, or risk disruptions. The reason for the warning is the imminent revocation of digital certificates that have been used to sign previous Connectwise software builds, “due to concerns raised by a third-party researcher about how ScreenConnect could potentially be misused by … More → The post Connectwise is rotating code signing certificates. What happened? appeared first on Help Net Security.
- SpecterOps Privilege Zones enables security teams to define logical access boundariesby Industry News on June 11, 2025 at 1:22 pm
SpecterOps introduced Privilege Zones, a new addition to its flagship BloodHound Enterprise platform. Privilege Zones enable teams to define custom security boundaries around business-critical resources and enforce least privilege access continuously in on-prem, cloud and hybrid environments. IT and security teams go to great lengths to configure identity properly, but the sheer magnitude and complexity of enterprise cloud and on-prem environments, along with the proliferation of human and non-human identities, make this an impossible task. … More → The post SpecterOps Privilege Zones enables security teams to define logical access boundaries appeared first on Help Net Security.
- Trustwise protects AI deployments from security risksby Industry News on June 11, 2025 at 1:15 pm
Trustwise introduced Harmony AI, a runtime trust layer and control tower designed for enterprises deploying fleets of generative and agentic AI systems. Harmony AI embeds “trust as code” directly into AI systems, empowering CISOs, developers, and AI leaders to shield their AI deployments from security risks as they scale. Co-developed with leading financial and healthcare institutions over the past two years, Harmony AI delivers enterprise-grade security and control in production, achieving 90-100% runtime alignment with … More → The post Trustwise protects AI deployments from security risks appeared first on Help Net Security.
- Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053)by Zeljka Zorz on June 11, 2025 at 11:13 am
For June 2025 Patch Tuesday, Microsoft has fixed 66 new CVEs, including a zero-day exploited in the wild (CVE-2025-33053). Also, Adobe Commerce and Magento Open Source users are urged to update quickly. About CVE-2025-33053 CVE-2025-33053 is a remote code execution vulnerability in Web Distributed Authoring and Versioning (WebDAV), which is a protocol for extending HTTP protocol functionality for interacting with files. Flagged by Check Point researchers, the vulnerability has been exploited in March 2025 to … More → The post Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053) appeared first on Help Net Security.